From 5a5cc28fb34fae2fc2267c19310e9bcf671ab8fc Mon Sep 17 00:00:00 2001
From: hefuc-oai <hefuc@openai.com>
Date: Mon, 6 Jul 2026 22:09:07 +0000
Subject: [PATCH] cloud-config: make managed layer handling explicit

---
 codex-rs/cloud-config/src/backend.rs       | 6 ++++--
 codex-rs/cloud-config/src/cache_tests.rs   | 6 ++++--
 codex-rs/cloud-config/src/service_tests.rs | 6 ++++--
 codex-rs/cloud-config/src/validation.rs    | 5 ++++-
 4 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/codex-rs/cloud-config/src/backend.rs b/codex-rs/cloud-config/src/backend.rs
index d99fd694ee..8b66a4a79b 100644
--- a/codex-rs/cloud-config/src/backend.rs
+++ b/codex-rs/cloud-config/src/backend.rs
@@ -4,8 +4,10 @@ use codex_backend_client::DeliveredTomlFragment;
 use codex_config::CloudConfigBundle;
 use codex_config::CloudConfigFragment;
 use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudConfigTomlManagedLayers;
 use codex_config::CloudRequirementsFragment;
 use codex_config::CloudRequirementsTomlBundle;
+use codex_config::CloudRequirementsTomlManagedLayers;
 use codex_login::CodexAuth;
 use std::future::Future;
 
@@ -110,11 +112,11 @@ pub(crate) fn bundle_from_response(response: ConfigBundleResponse) -> CloudConfi
     CloudConfigBundle {
         config_toml: CloudConfigTomlBundle {
             enterprise_managed: config_toml,
-            ..Default::default()
+            managed_layers: CloudConfigTomlManagedLayers::default(),
         },
         requirements_toml: CloudRequirementsTomlBundle {
             enterprise_managed: requirements_toml,
-            ..Default::default()
+            managed_layers: CloudRequirementsTomlManagedLayers::default(),
         },
     }
 }
diff --git a/codex-rs/cloud-config/src/cache_tests.rs b/codex-rs/cloud-config/src/cache_tests.rs
index 1ccfdb5901..798dc11e35 100644
--- a/codex-rs/cloud-config/src/cache_tests.rs
+++ b/codex-rs/cloud-config/src/cache_tests.rs
@@ -2,8 +2,10 @@ use super::*;
 use codex_config::AbsolutePathBuf;
 use codex_config::CloudConfigFragment;
 use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudConfigTomlManagedLayers;
 use codex_config::CloudRequirementsFragment;
 use codex_config::CloudRequirementsTomlBundle;
+use codex_config::CloudRequirementsTomlManagedLayers;
 use pretty_assertions::assert_eq;
 use std::path::Path;
 use tempfile::tempdir;
@@ -16,7 +18,7 @@ fn test_bundle() -> CloudConfigBundle {
                 name: "Base config".to_string(),
                 contents: "model = \"gpt-5\"".to_string(),
             }],
-            ..Default::default()
+            managed_layers: CloudConfigTomlManagedLayers::default(),
         },
         requirements_toml: CloudRequirementsTomlBundle {
             enterprise_managed: vec![CloudRequirementsFragment {
@@ -24,7 +26,7 @@ fn test_bundle() -> CloudConfigBundle {
                 name: "Base requirements".to_string(),
                 contents: "allowed_approval_policies = [\"never\"]".to_string(),
             }],
-            ..Default::default()
+            managed_layers: CloudRequirementsTomlManagedLayers::default(),
         },
     }
 }
diff --git a/codex-rs/cloud-config/src/service_tests.rs b/codex-rs/cloud-config/src/service_tests.rs
index 999c818ac9..83db229c76 100644
--- a/codex-rs/cloud-config/src/service_tests.rs
+++ b/codex-rs/cloud-config/src/service_tests.rs
@@ -13,8 +13,10 @@ use codex_backend_client::DeliveredTomlFragment;
 use codex_config::AbsolutePathBuf;
 use codex_config::CloudConfigFragment;
 use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudConfigTomlManagedLayers;
 use codex_config::CloudRequirementsFragment;
 use codex_config::CloudRequirementsTomlBundle;
+use codex_config::CloudRequirementsTomlManagedLayers;
 use codex_config::types::AuthCredentialsStoreMode;
 use codex_login::AuthKeyringBackendKind;
 use codex_login::auth::AgentIdentityAuth;
@@ -197,11 +199,11 @@ fn test_bundle() -> CloudConfigBundle {
     CloudConfigBundle {
         config_toml: CloudConfigTomlBundle {
             enterprise_managed: vec![test_config_fragment()],
-            ..Default::default()
+            managed_layers: CloudConfigTomlManagedLayers::default(),
         },
         requirements_toml: CloudRequirementsTomlBundle {
             enterprise_managed: vec![test_requirements_fragment()],
-            ..Default::default()
+            managed_layers: CloudRequirementsTomlManagedLayers::default(),
         },
     }
 }
diff --git a/codex-rs/cloud-config/src/validation.rs b/codex-rs/cloud-config/src/validation.rs
index ba7f08a165..4c386ec72a 100644
--- a/codex-rs/cloud-config/src/validation.rs
+++ b/codex-rs/cloud-config/src/validation.rs
@@ -18,9 +18,12 @@ pub(crate) fn validate_bundle(
             )
         })?;
     let CloudConfigBundleLayers {
+        baseline_config: _,
+        system_overlay_config: _,
         enterprise_managed_config: _,
+        baseline_requirements: _,
+        system_overlay_requirements: _,
         enterprise_managed_requirements,
-        ..
     } = bundle_layers;
 
     compose_requirements(enterprise_managed_requirements).map_err(|err| {